Summary

  • IPCO’s 2025 report assigns 778 communications-data errors to the SPoC column, including 302 time/date errors, 262 incorrect identifiers and 182 data-type errors.
  • The 2026 strategy extends source-document checks beyond IP-address resolution and carries the application record into inter-agency hand-offs.

The official record has a familiar weak point: a number moves from one form to another, and the number that arrives is not the number that left. Britain’s communications-data system has spent years placing a human control at that hand-off. The Single Point of Contact, or SPoC, checks the request and its lawful basis. The latest error table shows how much of the burden sits at that desk.

The Investigatory Powers Commissioner’s Office (IPCO) counted 1,591 communications-data errors in 2025. Its table assigns 778 to the SPoC responsibility column, compared with 513 for applicants and 300 for telecommunications and postal operators. Within the SPoC total, 302 were time or date errors, 262 involved an incorrect identifier and 182 concerned the data type. The rest were 11 “other” errors and 21 cases without IPA authority. The table classifies reported errors by role; its useful reading is where the process needs a check.

The total needs careful handling. IPCO says the definition changed and its 2025 table includes errors reported as reportable errors and potential relevant errors. That makes a straight comparison with 2024 a poor measure of whether the new process works. The report also says most errors arose from a simple number-or-letter transposition and were usually detected before harm or prejudice. A near miss caught in a review is still a control doing work; it is also evidence of where the process can fail.

Under the 2025 Communications Data Code of Practice, the SPoC is responsible for assuring that Part 3 authorisations are lawful and free from errors. IPCO’s report says the Code also requires public authorities to follow an Error Reduction Strategy agreed by the Investigatory Powers Commissioner and Home Office. The 2026 Error Reduction Strategy now puts more of that assurance into a recorded chain. It replaces the prior Annex E and moves from a primary focus on IP Address Resolution (IPAR) to all internet-based communications-data applications.

For an internet request, the investigator should attach a source or supporting document where possible. The source has to have provenance and reliability that the applicant and SPoC can establish. If no source document exists, the application must say so and explain why. For internet data requests other than IPAR, the SPoC compares the application’s data line with the source material. The document is not paperwork around the request; it is the reference point against which the request can be checked.

The strategy also calls out the quiet traps of data entry. UK dates commonly put the day before the month; US formats reverse that order. The investigator and SPoC are told to agree the format, and to copy and paste identifiers and dates where possible. If that cannot be done, a second person should verify the entry. In IPAR requests, the first peer review checks identifiers, dates, times and time-zone adjustments against the source before submission to IPCO. A second SPoC normally carries out the check; another agreed person requires approval from both the senior responsible officer (SRO) and the Investigatory Powers Commissioner.

There may be a second check before a request is served on an operator, when time and access allow. Automated acquisition makes that review impossible, which raises the importance of the earlier review. A third check comes before data are released: returned identifiers are matched to the application and source. Unexpected results go back to the SPoC. Each step asks the same practical question at a different point: is this still the person, time and data type the authority set out to acquire?

The most consequential change may happen after the operator responds. When an enforcement package passes to another organisation, the investigator must include the source document and original application where available, plus a schedule of the material supplied. If either document is missing, the package records why. The receiving agency checks the schedule and decides whether the material it has is enough to proceed. A supervisor reviews the package; the strategy says no executive action should follow without adequate corroboration.

That hand-off turns a correction rule into an accountability rule. A receiving officer can see the request, its source and the returned data as one trail. If a date changes, a username is mistyped or an unexpected result appears, the trail points to the stage that needs examination. IPCO’s own inspection method uses a version of the same test: in some cases it obtains data from a telecommunications operator and cross-checks them against the authority’s application.

The 2026 strategy was due to be fully implemented by 2 November. The public documents establish that deadline but do not publish a completion count by authority. The next useful evidence is therefore not another promise of “checks”: it is whether inspected records show source provenance, peer-review sign-off, recorded reasons when reviews cannot happen, and the same application travelling with the result.

The 778 in the SPoC column gives the human gatekeeper a concrete job: make each check traceable. A request that carries its source, review history and receiving-agency schedule can be reconstructed after the fact. A number copied into a portal and stripped of its origin can only be trusted. In communications-data work, trust is the weaker control.

Sources